Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tanstack/form
main @ 6a73479
2
Fixes
2
CVEs
CRITICAL
Peak severity
Highlights
Information Disclosure: 1 prior fix. Scrutinize any change in this area.
packages/form-core/src/mergeForm.ts: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: The `mutateMergeDeep` utility previously merged keys recursively without validating if the key was a forbidden property like `__proto__`, `constructor`, or `prototype`, which could allow an attacker to pollute the global object prototype and potentially achieve remote code execution or application denial of service.
Information Disclosure: Sensitive form payloads and structural data were being printed directly to standard output via console logging during server-side validation, potentially leaking authentication tokens, personally identifiable information (PII), or private fields to centralized monitoring systems.